External risk intelligence

Juniper Junos OS rpd Stack Buffer Overflow Allows Root Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-33796

The vulnerability involves the routing protocol daemon (rpd) and is triggered via BGP monitoring (BMP). While BGP and routing protocols often operate between peering networks and are generally restricted to trusted peer-to-peer connections rather than the public-facing internet, they are network-reachable in infrastructure environments, making internet-scale exposure possible but not a common public-facing web or gateway service.

Buffer Overflow

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Juniper Networks' Junos OS routing protocol daemon, potentially allowing unauthorized individuals to gain full control of affected systems. This issue stems from a buffer overflow that can be exploited through a specific configuration of Border Gateway Protocol (BGP) route monitoring. The primary concern is confirming whether our network infrastructure utilizes this specific technology and is exposed.

A flaw in network routing software allows system takeover.
Affects critical network infrastructure.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with configured external access to a network device could leverage the routing protocol daemon's route monitoring feature to overflow a buffer. This overflow could allow the attacker to execute commands with the highest level of system privileges.

Network access required.
Triggered via BMP route monitoring.
Arbitrary command execution with root privileges.

Live Threat

Current exploitation, exposure, and threat context

A configured external BGP neighbor could potentially execute arbitrary commands with root privileges on affected Juniper devices. This could occur when the device is configured to use BMP route monitoring, allowing an attacker to leverage a stack-based buffer overflow in the routing protocol daemon.

Routing protocol daemon compromised.
External BGP neighbor triggers overflow.
Arbitrary commands executed with root.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon (rpd) is susceptible to a critical stack-based buffer overflow vulnerability via BMP route monitoring. This requires careful assessment to identify all instances of the affected software, confirm network reachability and business criticality, and assign ownership for remediation. The first practical move is to determine the scope of deployment and prioritize actions based on potential exposure and impact.

Network and security teams should own this issue.
Verify BMP route monitoring configurations are enabled.
Plan remediation based on identified exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Junos OS routing protocol daemon (rpd)?

The routing protocol daemon (rpd) is a core software component in Juniper Networks Junos OS and Junos OS Evolved. It acts as the brain for the device, managing complex routing information, calculating network paths, and maintaining communication with other routers using protocols like BGP. Because it handles essential traffic routing decisions at the system level, it requires deep integration with the operating system.

How does CVE-2026-33796 cause a buffer overflow?

This vulnerability is a stack-based buffer overflow, categorized as CWE-121. It occurs when the routing daemon receives more data than it can safely process within its allocated memory space, specifically during BGP Monitoring Protocol (BMP) operations. By sending specially crafted data, an attacker can overwrite adjacent memory, which allows them to redirect program execution and run unauthorized commands with root-level system privileges.

What triggers the vulnerability in this daemon?

The issue is triggered specifically when a device is configured to use BMP (BGP Monitoring Protocol) to track route information. It requires an attacker to interact with the device as a configured external BGP neighbor. Crucially, the vulnerability is not triggered by standard network traffic; it requires the specific activation and use of the BMP feature in the routing configuration to create the pathway for the exploit.

Is my network device at risk according to Halo Surface Signal?

Halo Surface Signal indicates that while this is classified as an external vulnerability, risk is tied to how you use BGP. Routing protocols typically operate between trusted peers rather than being exposed on the public internet. However, since the daemon is network-reachable, infrastructure environments running BMP are at higher risk than those where BGP sessions are strictly isolated or BMP is disabled.

How should I respond to CVE-2026-33796?

The immediate priority is to identify which of your network devices are running Junos OS or Junos OS Evolved and have BMP route monitoring enabled. Coordinate with your network and security teams to review current device configurations. Once you have a clear inventory of affected, active BMP configurations, you can prioritize patching or applying vendor-provided mitigations based on the business criticality of those specific routers.

References

supportportal.juniper.net/JSA112187

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.